1
$\begingroup$

I am generating random bytes (16 or 32 bytes at a time), and I want to encrypt them using a 128 bit AES key in CBC mode. Am I really weakening this horribly if I am reusing the same IV and key each time I encrypt a set of random bytes, given that there is no structure at all in the data I am encrypting?

We can add a nonce to our scheme and change the IV each time, I am just trying to understand why (if) it is really required when encrypting data with no structure?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Note that, like basically all non-authenticated modes, CBC on its own will still be malleable. ​ ​ $\endgroup$
    – user991
    Apr 6, 2016 at 3:07

1 Answer 1

Reset to default
2
$\begingroup$

No, you're not weakening your data in that case. You could even use ECB in to encrypt random data. Symmetric key wrapping often just uses ECB. But beware that it depends on how many bytes you encrypt.

You may want to make sure all bytes are random (if you know the plaintext size in advance). Think about encrypting a single random byte and filling the rest with zero's or PKCS#7 compatible padding. Identical values would be easily detected.

You may want to very clearly document what you're doing though, because if you add context / structure to your random bytes it would be pretty easy to mess things up.

You could use SIV if you want to have secure, authenticated key wrapping for your random bytes. You would not need to generate a random IV and SIV would handle additional structure well. You would need to have an implementation of SIV and room for the synthetic IV (which is also the authentication tag) though.

Improve this answer
$\endgroup$
4
  • $\begingroup$ Without further clarification, I don't think you can quite make this claim yet. He says the bytes are random, but he doesn't say how large they are! If he's only encrypting, for example, one byte at a time, this scheme loses indistinguishability. This only retains the full security of AES-128 if he's encrypting at least 16 bytes at a time. $\endgroup$
    – Stephen Touset
    Apr 6, 2016 at 4:01
  • $\begingroup$ I have edited the post to clarify I was intending to encrypt 16 or 32 bytes at a time, thanks for pointing that out. Given this, it seems as though using CBC with a non-changing IV (or even ECB) is going to be perfectly fine? $\endgroup$
    – McGee
    Apr 6, 2016 at 4:18
  • 1
    $\begingroup$ Regardless, isnt it easy enough to generate a random iv each time? It wont hurt. $\endgroup$
    – Luke Park
    Apr 6, 2016 at 21:14
  • 1
    $\begingroup$ @LukePark If you can then you should, I certainly agree with that. $\endgroup$
    – Maarten Bodewes ♦
    Apr 7, 2016 at 9:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.